Re: telnetd vulnerability from BUGTRAQ
On 28 Sep 2004, Dariush Pietrzak wrote:
>>
>> I don't know what you imagine is "encrypted" in FTP, though, since that
>> is not part of the specification or the standard implementations.
>
> oh, not part of THIS: http://www.ietf.org/rfc/rfc2246.txt specification?
> that is like, what, 5 years old?
Why, no. That specification being for TLS, it has very little to do
with the specification for the FTP protocol. It does mention it, once,
as an application level protocol that could benefit from the
introduction of TLS, though.
> Well, what about this:
> http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html
> and this:
> http://www.faqs.org/ftp/internet-drafts/draft-murray-auth-ftp-ssl-13.txt
...now, /that/ is closer to evidence in favour of your statements.
It is, however, a draft document, even if it is close to becoming a
standard. That isn't a strong basis for any claim that the standard
does include encryption, or that encryption is a standard part of FTP.
That said, I was partially wrong - there is broader support for TLS in
FTP than I was aware of, reviewing the set of implementations listed
with that draft.
Regards,
Daniel
--
It is preoccupation with possessions, more than anything else,
that prevents us from living freely and nobly.
-- Bertrand Russell
Reply to: